DetailedCAPEC-551
CAPEC-551: Modify Existing Service
Description
When an operating system starts, it also starts programs called services or daemons. Modifying existing services may break existing services or may enable services that are disabled/not commonly used.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Not rated by MITRE
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Inject Unexpected Items
Mitigations
- Limit privileges of user accounts so service changes can only be performed by authorized administrators. Also monitor any service changes that may occur inadvertently.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-SFASystem File Analysis1 shared
- D3-SCPSystem Configuration Permissions1 shared
- D3-RDRestore Database1 shared
- D3-DIData Inventory1 shared
- D3-CFContent Filtering1 shared
- D3-CMContent Modification1 shared
- D3-DFDecoy File1 shared
- D3-FAFile Analysis1 shared
- D3-FEFile Encryption1 shared
- D3-FEVFile Eviction1 shared
- D3-FIMFile Integrity Monitoring1 shared
- D3-LFPLocal File Permissions1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2013-09-005Service Outlier Executables1 shared
- CAR-2014-05-002Services launching Cmd1 shared
- CAR-2014-03-005Remotely Launched Executables via Services1 shared
- CAR-2014-02-001Service Binary Modifications1 shared
- CAR-2013-01-002Autorun Differences1 shared
- CAR-2013-04-002Quick execution of a series of suspicious commands1 shared